EUVD-2026-51274
GHSA-6qjg-94q2-5wvp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable JMX/SOAP connector gives AV:N; authenticated management access needed so PR:L; gadget-chain/preconditions justify AC:H; JVM RCE with scope change yields S:C and full C/I/A.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
AnalysisAI
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the WebSphere SOAP/JMX management connector plus low-privilege authentication (CVSS PR:L), so the attacker must hold valid credentials or an authenticated session able to interact with the JMX/SOAP interface - it is not remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) indicates a network-reachable but non-trivial attack: high attack complexity and a requirement for low-privilege authentication temper an otherwise severe scope-changed, full-impact RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege credentials or a foothold that can reach the WebSphere SOAP/JMX connector sends a crafted serialized Java object to the management endpoint; when the server deserializes it, a gadget chain on the classpath executes attacker-controlled code in the server JVM. Given AC:H, the attacker must satisfy specific preconditions (reachable connector, viable gadget chain), and no public POC is currently known, so a real attack would likely require custom tooling. |
| Remediation | Apply the vendor-supplied fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7277544 (Patch available per vendor advisory); review that bulletin for the exact APAR/interim fix or fix pack level for WebSphere Application Server 9.0 and 8.5, as the input does not include a specific fixed version number to cite. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM WebSphere Application Server 9.0 or 8.5 and restrict network access to the SOAP/JMX management connector to only authorized administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today